VCP-DCV vSphere Security — 10 Questions

Question 1

Which TWO actions are required to enable encrypted vSphere vMotion for all virtual machines in a cluster?

Accepted Answer

Set the vMotion encryption policy to 'Encrypt all data' in the cluster settings.. Setting the vMotion encryption policy to 'Encrypt all data' enforces encryption for all vMotion migrations in the cluster, using TLS 1.2 and host-based certificates. Option D is incorrect because Active Directory domain membership is not required; vMotion encryption works with the default host certificates as long as the hosts trust each other's certificates, which is achieved by default in a cluster. A KMS (Option B) is not needed for vMotion encryption, only for VM-level encryption. Storage DRS (Option C) is unrelated. Option E, 'Encrypt when supported', does not enforce encryption for all VMs; it only encrypts when both source and target hosts support it, which may not apply to all migrations.

Answer

Configure a Key Management Server (KMS) for the cluster.

Answer

Enable Storage DRS on the cluster.

Answer

Ensure all ESXi hosts in the cluster are joined to the same Active Directory domain.

Answer

Set the vMotion encryption policy to 'Encrypt when supported' in the cluster settings.

Question 2

An organization is implementing vSphere Trust Authority for sensitive workloads. The administrator must configure the trusted ESXi hosts to attest to vCenter Server. Which component is responsible for performing attestation?

Accepted Answer

A separate vCenter Server instance acting as the Trust Authority. VSphere Trust Authority uses a dedicated vCenter Server instance (Trust Authority vCenter) to perform attestation of ESXi hosts. Option A is incorrect because the administrator's workstation is not part of the trust chain and does not perform attestation. Option C is incorrect because the Key Provider (KMS) server is used for encryption key management, not for host attestation. Option D is incorrect because the trusted ESXi hosts themselves are the subjects of attestation; they do not perform attestation.

Answer

The administrator's workstation

Answer

The Key Provider (KMS) server

Answer

The trusted ESXi hosts themselves

Question 3

An organization is using vSphere Trust Authority (vTA) to secure ESXi hosts. A newly added ESXi host fails to attest with the Trust Authority. The administrator verifies that the host is connected to the vTA cluster and the trust relationship is configured. What is the most likely cause of the attestation failure?

Accepted Answer

The TPM on the ESXi host is disabled or not properly initialized.. VTA attestation requires the ESXi host's TPM to be enabled and properly initialized. Option A is incorrect because the administrator verified that the host is connected to the vTA cluster, so network isolation is unlikely. Option B is incorrect because the ESXi host does not need to be in the same cluster as the Trust Authority; trust is configured separately. Option C is incorrect because vTA relies on the host's physical TPM, not a virtual TPM (vTPM).

Answer

The Trust Authority's network is isolated from the ESXi host's management network.

Answer

The ESXi host is not in the same cluster as the Trust Authority.

Answer

The ESXi host does not have a virtual Trusted Platform Module (vTPM) attached.

Question 4

An organization wants to secure management traffic between vCenter Server and ESXi hosts. The security policy mandates disabling all versions of TLS below 1.2. After the administrator configures vCenter to use only TLS 1.2, several ESXi hosts (all version 6.0) lose connectivity to vCenter. The hosts remain operational but show as disconnected in the vSphere Web Client. The administrator needs to restore management while maintaining the security requirement. Which action should the administrator take?

Accepted Answer

Upgrade the legacy ESXi hosts to version 6.5 or later.. ESXi 6.0 only supports TLS 1.0; to use TLS 1.2, hosts must be upgraded to ESXi 6.5 or later. Option B is wrong because disabling certificate verification does not address the TLS version issue and weakens security. Option C is wrong because SSH is not used for vCenter-to-ESXi management communication. Option D is wrong because re-enabling TLS 1.0 would violate the security policy.

Answer

Disable certificate verification on the vCenter Server.

Answer

Use SSH to connect vCenter to the ESXi hosts for management.

Answer

Re-enable TLS 1.0 on the vCenter Server as a temporary workaround.

Question 5

An administrator is troubleshooting a situation where a virtual machine cannot be powered on. The error message indicates insufficient permissions. The VM is in a folder named 'Production' and the administrator has been assigned a custom role with 'Virtual machine > Power On' permission at the folder level. However, the VM is also in a resource pool. What additional permission is most likely missing?

Accepted Answer

Resource > Assign virtual machine to resource pool permission on the resource pool. To power on a virtual machine that resides in a resource pool, the user must have the 'Resource > Assign virtual machine to resource pool' permission on that resource pool. Even though the user has 'Virtual machine > Power On' at the folder level, the VM's association with the resource pool introduces an additional authorization check. Without this resource pool permission, the power-on operation fails with an insufficient permissions error.

Answer

Network > Assign network permission on the network

Answer

Datastore > Allocate space permission on the datastore

Answer

Virtual machine > Configuration permission on the VM

Question 6

A security audit reveals that an ESXi host has been compromised due to an attacker gaining root access via the DCUI. The host is configured with a default DCUI password. Which security best practice should have been implemented to prevent this?

Accepted Answer

Configure the DCUI lockdown mode to 'Normal'. DCUI Lockdown Mode 'Normal' disables direct root access via the Direct Console User Interface (DCUI) by requiring authentication through vCenter Single Sign-On (SSO). This prevents an attacker from using the default or weak DCUI password to gain root access, as the root account is no longer accepted for DCUI login. The mode still allows authorized vCenter administrators to access the host via the DCUI using their SSO credentials, maintaining manageability while eliminating the root password attack vector.

Answer

Disable the DCUI service

Answer

Set a strong password for the root account

Answer

Disable SSH access

Question 7

A vSphere administrator needs to ensure that all HTTPS traffic to ESXi hosts is encrypted using TLS 1.2. Where should the administrator configure the minimum TLS version?

Accepted Answer

Host Advanced Settings (Config.HostAgent.plugins.vimsvc.auth.minTLSVersion). The minimum TLS version for ESXi host HTTPS traffic is configured via the host advanced setting `Config.HostAgent.plugins.vimsvc.auth.minTLSVersion`. This setting directly controls the TLS protocol version used by the ESXi host's HTTP services, including the vSphere Client and API endpoints, ensuring only TLS 1.2 or higher is accepted.

Answer

Security Profile in the vSphere Client

Answer

vCenter Server Appliance (VAMI) web interface

Answer

ESXi Firewall rules

Question 8

An administrator is configuring a distributed switch and needs to ensure that all virtual machine traffic on a specific VLAN is isolated. The administrator creates a port group with VLAN ID 100. However, a security scanner reports that packets from this VLAN are appearing on other VLANs. Which security policy setting on the distributed switch should the administrator verify?

Accepted Answer

VLAN trunking. The VLAN trunking policy on a distributed switch controls whether a port group can pass multiple VLAN IDs (trunk mode) or is restricted to a single VLAN (access mode). When VLAN trunking is enabled, the port group may forward traffic from VLAN 100 onto other VLANs if the virtual switch is configured to allow it, breaking isolation. The administrator should verify that VLAN trunking is disabled (set to 'Reject') to ensure strict VLAN isolation.

Answer

MAC address changes

Answer

Forged transmits

Answer

Promiscuous mode

Question 9

A vSphere environment uses Active Directory for authentication. The administrator notices that users from a specific AD group cannot log in to the vCenter Server, although other AD users can. The group is added to vCenter Server with the correct permissions. What is the most likely cause?

Accepted Answer

The domain of the group is not configured as an identity source in vCenter Single Sign-On. The most likely cause is that the domain of the group is not configured as an identity source in vCenter Single Sign-On. Even if the group is added with correct permissions in vCenter Server, vCenter SSO must be able to authenticate users against the domain. Without the domain listed as an identity source, vCenter cannot validate the credentials of users from that group, causing authentication failures for all users in that domain.

Answer

The users are not members of the vCenter Single Sign-On domain

Answer

The user accounts have expired passwords

Answer

The group is nested within another group

Question 10

Which TWO actions are recommended to secure the vCenter Server Appliance (VCSA)?

Accepted Answer

Change the default 'root' password. Changing the default 'root' password is a fundamental security best practice for the VCSA. The default password is well-known and documented, leaving the appliance vulnerable to unauthorized access if not changed immediately after deployment. This action directly mitigates the risk of brute-force or credential-based attacks against the root account.

Answer

Enable the auto-lock feature for the admin account

Answer

Configure the password policy for local accounts

Answer

Enable FIPS 140-2 compliance mode